[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT6VUQEKMt4OHA7NkC_r7lFQqkYGoq4iBED-NOdC0gNw":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"4ac099df-ba69-4f10-afa7-35c6588cff46","CJEU - C-317\u002F25","cjeu-c-317-25-a36c1f","Facts ← Older revision Revision as of 06:31, 23 September 2026 Line 107: Line 107: When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed.","A French Data Protection Authority (DPA) fined an ISP €600,000 for invalid consent regarding direct marketing. The ISP's \"partners\" were not identified, meaning subscribers did not know their data could be used by unknown entities. The case reached the French Supreme Court, which referred questions to the CJEU regarding whether consent given to a data collector for marketing by a category of recipients allows an unidentified member of that category to conduct direct marketing without new consent.","CJEU case C-317\u002F25 questions consent validity for unidentified marketing partners.","Help CJEU - C-317\u002F25: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 14:17, 22 September 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators326 editsTag: Visual edit← Older edit Latest revision as of 06:31, 23 September 2026 view source Mba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators984 editsm Tag: Visual edit Line 107: Line 107: When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing.When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine.Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”.The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed.The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. Latest revision as of 06:31, 23 September 2026 CJEU - C-317\u002F25 Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(11) GDPR Article 13 GDPR Article 14 GDPR Article 13 ePrivacy DirectiveArticle L. 34-5 of the French Post and Electronic Telecommunications Code (CPCE)Article 4 de la loi 78-17 du 6 janvier 1978 Decided: 17.09.2026 Parties: Commission nationale de l’informatique et des libertés (CNIL) Syndicat professionnel Data et Marketing France (DMA France) Association Alliance Digitale Syndicat Collectif pour les acteurs du marketing digital (CPA) Association Le Groupement des éditeurs de contenus et services en ligne (GESTE) Case Number\u002FName: C-317\u002F25 European Case Law Identifier: Reference from: Conseil d’ÉtatSAN-2023-015 Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: bms An AG opined that consent to marketing by unidentified “partners” is not sufficiently informed. A later controller must obtain fresh consent before sending electronic direct marketing. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the CJEU for a preliminary ruling. Advocate General Opinion The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under Article 4(11) GDPR. For consent to be informed, the data subject must in particular know the identity of the controller carrying out the marketing. Therefore, consent to the use of personal data by an ISP’s unspecified “partners” does not amount to consent to receive marketing from any undertaking falling within that category. Where the controller’s identity was unknown when consent was obtained, fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An unsubscribe option in that communication cannot remedy the absence of prior consent. The AG therefore considered it unnecessary to answer the second question. In the alternative, the AG considered that the category of recipients must ","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-317\u002F25&diff=53157&oldid=53155","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-23T06:31:34+00:00","2026-09-23T08:00:09.411889+00:00",7,[18],{"name":19,"type":20},"ISP","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,32,37,39],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":33},{"id":34,"icon":23,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":21,"icon":23,"name":24,"slug":25},{"category":40},{"id":41,"icon":23,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]